In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Fix command flush on cable pull
System crash due to command failed to flush back to SCSI layer.
BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI CPU: 27 PID: 793455 Comm: kworker/u130:6 Kdump: loaded Tainted: G OE --------- - - 4.18.0-372.9.1.el8.x86_64 #1 Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 09/03/2021 Workqueue: nvme-wq nvme_fc_connect_ctrl_work [nvme_fc] RIP: 0010:__wake_up_common+0x4c/0x190 Code: 24 10 4d 85 c9 74 0a 41 f6 01 04 0f 85 9d 00 00 00 48 8b 43 08 48 83 c3 08 4c 8d 48 e8 49 8d 41 18 48 39 c3 0f 84 f0 00 00 00 <49> 8b 41 18 89 54 24 08 31 ed 4c 8d 70 e8 45 8b 29 41 f6 c5 04 75 RSP: 0018:ffff95f3e0cb7cd0 EFLAGS: 00010086 RAX: 0000000000000000 RBX: ffff8b08d3b26328 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffff8b08d3b26320 RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffffffffffe8 R10: 0000000000000000 R11: ffff95f3e0cb7a60 R12: ffff95f3e0cb7d20 R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8b2fdf6c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000002f1e410002 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: __wake_up_common_lock+0x7c/0xc0 qla_nvme_ls_req+0x355/0x4c0 [qla2xxx] qla2xxx [0000:12:00.1]-f084:3: qlt_free_session_done: se_sess 0000000000000000 / sess ffff8ae1407ca000 from port 21:32:00:02:ac:07:ee:b8 loop_id 0x02 s_id 01:02:00 logout 1 keep 0 els_logo 0 ? __nvme_fc_send_ls_req+0x260/0x380 [nvme_fc] qla2xxx [0000:12:00.1]-207d:3: FCPort 21:32:00:02:ac:07:ee:b8 state transitioned from ONLINE to LOST - portid=010200. ? nvme_fc_send_ls_req.constprop.42+0x1a/0x45 [nvme_fc] qla2xxx [0000:12:00.1]-2109:3: qla2x00_schedule_rport_del 21320002ac07eeb8. rport ffff8ae598122000 roles 1 ? nvme_fc_connect_ctrl_work.cold.63+0x1e3/0xa7d [nvme_fc] qla2xxx [0000:12:00.1]-f084:3: qlt_free_session_done: se_sess 0000000000000000 / sess ffff8ae14801e000 from port 21:32:01:02:ad:f7:ee:b8 loop_id 0x04 s_id 01:02:01 logout 1 keep 0 els_logo 0 ? __switch_to+0x10c/0x450 ? process_one_work+0x1a7/0x360 qla2xxx [0000:12:00.1]-207d:3: FCPort 21:32:01:02:ad:f7:ee:b8 state transitioned from ONLINE to LOST - portid=010201. ? worker_thread+0x1ce/0x390 ? create_worker+0x1a0/0x1a0 qla2xxx [0000:12:00.1]-2109:3: qla2x00_schedule_rport_del 21320102adf7eeb8. rport ffff8ae3b2312800 roles 70 ? kthread+0x10a/0x120 qla2xxx [0000:12:00.1]-2112:3: qla_nvme_unregister_remote_port: unregister remoteport on ffff8ae14801e000 21320102adf7eeb8 ? set_kthread_struct+0x40/0x40 qla2xxx [0000:12:00.1]-2110:3: remoteport_delete of ffff8ae14801e000 21320102adf7eeb8 completed. ? ret_from_fork+0x1f/0x40 qla2xxx [0000:12:00.1]-f086:3: qlt_free_session_done: waiting for sess ffff8ae14801e000 logout
The system was under memory stress where driver was not able to allocate an SRB to carry out error recovery of cable pull. The failure to flush causes upper layer to start modifying scsi_cmnd. When the system frees up some memory, the subsequent cable pull trigger another command flush. At this point the driver access a null pointer when attempting to DMA unmap the SGL.
Add a check to make sure commands are flush back on session tear down to prevent the null pointer access.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-debug-develUpgrade kernel-debug-modules-extraUpgrade kernel-64k-debug-modulesUpgrade kernel-64k-debug-develUpgrade kernel-rt-modulesUpgrade kernel-zfcpdump-develUpgrade kernel-docUpgrade kernel-uki-virtUpgrade kernel-debug-modulesUpgrade kernel-coreUpgrade kernel-modules-extraUpgrade kernel-debugUpgrade rtlaUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-modules-coreUpgrade kernel-64k-modules-coreUpgrade kernel-modulesUpgrade kernel-64k-develUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-modules-extraUpgrade kernel-modules-coreUpgrade kernel-rt-debugUpgrade kernel-headersUpgrade kernel-rt-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-develUpgrade kernel-rt-debug-modules-coreUpgrade kernel-tools-libsUpgrade kernel-rt-modules-coreUpgrade kernel-rt-debug-develUpgrade kernel-debug-coreUpgrade kernel-develUpgrade kernel-debug-uki-virtUpgrade kernel-64k-devel-matchedUpgrade kernel-64k-modulesUpgrade kernel-64kUpgrade kernel-devel-matchedUpgrade kernel-64k-debug-modules-coreUpgrade kernelUpgrade kernel-64k-debugUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-coreUpgrade kernel-64k-debug-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-64k-coreUpgrade kernel-abi-stablelistsUpgrade kernel-cross-headersUpgrade bpftoolUpgrade kernel-rtUpgrade kernel-64k-debug-modules-extraUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-toolsUpgrade rvUpgrade libperfUpgrade python3-perfUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-64k-modules-extraUpgrade perf | Nov 4, 2024 | May 1, 2024 |
| Amazon Linux Ami 2 | — | Upgrade python-perf-debuginfoUpgrade kernel-headersUpgrade kernelUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfoUpgrade python-perfUpgrade bpftoolUpgrade kernel-tools-develUpgrade perf-debuginfoUpgrade kernel-livepatch-5.10.215-203.850Upgrade perfUpgrade kernel-livepatch-4.14.345-262.561Upgrade kernel-toolsUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-devel | Aug 14, 2024 | May 1, 2024 |
| Debian | — | Upgrade linux | May 8, 2024 | May 1, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernelUpgrade kernel-toolsUpgrade kernel-tools-libs | Jul 16, 2024 | May 1, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade python3-perfUpgrade bpftoolUpgrade kernel | Oct 8, 2024 | May 1, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade python3-perfUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernelUpgrade bpftool | Oct 8, 2024 | May 1, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernel | Jul 17, 2024 | May 1, 2024 |
| Oracle_linux | — | Upgrade kernelUpgrade kernel-uek | Oct 16, 2024 | May 1, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernelUpgrade kernel-rt | Jul 25, 2024 | May 1, 2024 |
| Suse | — | Upgrade dtb-mediatekUpgrade kernel-debug-develUpgrade dtb-allwinnerUpgrade kernel-64kb-optionalUpgrade kernel-azure-baseUpgrade kernel-default-baseUpgrade kernel-rt_debugUpgrade dtb-hisiliconUpgrade kernel-64kb-develUpgrade kernel-default-optionalUpgrade dtb-armUpgrade dtb-amdUpgrade dlm-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade dtb-renesasUpgrade kernel-develUpgrade dtb-marvellUpgrade kernel-docsUpgrade kernel-rt-extraUpgrade kernel-debugUpgrade gfs2-kmp-defaultUpgrade dtb-broadcomUpgrade reiserfs-kmp-defaultUpgrade kernel-source-vanillaUpgrade kernel-azure-extraUpgrade dtb-appleUpgrade dtb-socionextUpgrade kernel-default-livepatch-develUpgrade kernel-kvmsmall-livepatch-develUpgrade dlm-kmp-rtUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rt_debug-develUpgrade kernel-devel-rtUpgrade dtb-alteraUpgrade dtb-xilinxUpgrade kselftests-kmp-azureUpgrade gfs2-kmp-azureUpgrade cluster-md-kmp-rtUpgrade dtb-nvidiaUpgrade kselftests-kmp-rtUpgrade kernel-azureUpgrade kernel-defaultUpgrade ocfs2-kmp-defaultUpgrade kernel-rt-livepatchUpgrade kernel-rt-develUpgrade reiserfs-kmp-rtUpgrade kernel-obs-buildUpgrade ocfs2-kmp-azureUpgrade kernel-debug-vdsoUpgrade dtb-amlogicUpgrade kernel-docs-htmlUpgrade kernel-rt-optionalUpgrade dtb-caviumUpgrade kernel-rt-livepatch-develUpgrade dtb-rockchipUpgrade dlm-kmp-64kbUpgrade ocfs2-kmp-rtUpgrade kselftests-kmp-64kbUpgrade kernel-sourceUpgrade kernel-rtUpgrade kselftests-kmp-defaultUpgrade kernel-symsUpgrade kernel-kvmsmall-vdsoUpgrade reiserfs-kmp-azureUpgrade kernel-default-vdsoUpgrade kernel-debug-livepatch-develUpgrade kernel-kvmsmall-develUpgrade kernel-default-base-rebuildUpgrade kernel-default-livepatchUpgrade kernel-rt-vdsoUpgrade kernel-azure-livepatch-develUpgrade ocfs2-kmp-64kbUpgrade dtb-lgUpgrade dtb-sprdUpgrade kernel-64kb-extraUpgrade kernel-source-rtUpgrade kernel-kvmsmallUpgrade kernel-devel-azureUpgrade gfs2-kmp-rtUpgrade reiserfs-kmp-64kbUpgrade kernel-zfcpdumpUpgrade kernel-default-extraUpgrade dtb-amazonUpgrade dlm-kmp-azureUpgrade kernel-source-azureUpgrade kernel-obs-qaUpgrade kernel-macrosUpgrade kernel-azure-develUpgrade kernel-64kbUpgrade gfs2-kmp-64kbUpgrade dtb-qcomUpgrade kernel-rt_debug-vdsoUpgrade kernel-default-manUpgrade kernel-azure-optionalUpgrade dtb-freescaleUpgrade kernel-syms-rtUpgrade dtb-exynosUpgrade cluster-md-kmp-azureUpgrade kernel-syms-azureUpgrade kernel-default-develUpgrade cluster-md-kmp-defaultUpgrade kernel-azure-vdsoUpgrade kernel-64kb-livepatch-develUpgrade dtb-apm | May 15, 2024 | May 1, 2024 |
| Ubuntu | — | Upgrade linux-image-5.15.0-1060-nvidia-lowlatencyUpgrade linux-image-aws-lts-20.04Upgrade linux-image-6.8.0-35-genericUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.4.0-1075-ibmUpgrade linux-image-5.15.0-1048-gkeopUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-5.15.0-1063-oracleUpgrade linux-image-5.4.0-1128-awsUpgrade linux-image-kvmUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.4.0-1047-xilinx-zynqmpUpgrade linux-image-azure-fdeUpgrade linux-image-bluefieldUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-awsUpgrade linux-image-5.4.0-1088-bluefieldUpgrade linux-image-5.15.0-1065-gcpUpgrade linux-image-5.4.0-1133-azureUpgrade linux-image-5.4.0-1040-iotUpgrade linux-image-6.8.0-35-lowlatency-64kUpgrade linux-image-aws-lts-22.04Upgrade linux-image-5.15.0-1060-nvidiaUpgrade linux-image-5.4.0-189-genericUpgrade linux-image-5.15.0-1035-xilinx-zynqmpUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.15.0-1068-azureUpgrade linux-image-6.8.0-1006-oracle-64kUpgrade linux-image-oracleUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-raspi-hwe-18.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1006-oemUpgrade linux-image-azure-cvmUpgrade linux-image-6.8.0-1008-azure-fdeUpgrade linux-image-6.8.0-1006-oracleUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-5.15.0-1058-ibmUpgrade linux-image-5.15.0-1062-gkeUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-6.8.0-35-generic-64kUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1004-gkeUpgrade linux-image-5.4.0-1095-gkeopUpgrade linux-image-5.4.0-1116-kvmUpgrade linux-image-azure-lts-20.04Upgrade linux-image-oem-20.04bUpgrade linux-image-5.4.0-1112-raspiUpgrade linux-image-5.15.0-1065-awsUpgrade linux-image-lowlatency-64kUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-oem-24.04aUpgrade linux-image-oem-20.04cUpgrade linux-image-oem-20.04dUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-5.15.0-116-genericUpgrade linux-image-oem-20.04Upgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-azure-lts-22.04Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-oemUpgrade linux-image-azureUpgrade linux-image-5.15.0-116-generic-lpaeUpgrade linux-image-gkeop-5.4Upgrade linux-image-5.15.0-1058-raspiUpgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-1068-azure-fdeUpgrade linux-image-gcpUpgrade linux-image-raspiUpgrade linux-image-generic-lpaeUpgrade linux-image-intelUpgrade linux-image-genericUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-ibm-lts-20.04Upgrade linux-image-gke-5.15Upgrade linux-image-5.4.0-1127-oracleUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-5.15.0-116-lowlatencyUpgrade linux-image-5.15.0-1064-gcpUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-gkeUpgrade linux-image-generic-64kUpgrade linux-image-gkeopUpgrade linux-image-6.8.0-1006-ibmUpgrade linux-image-5.4.0-189-generic-lpaeUpgrade linux-image-6.8.0-1005-raspiUpgrade linux-image-raspi2Upgrade linux-image-oracle-64kUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-5.4.0-1132-gcpUpgrade linux-image-5.15.0-1060-intel-iotgUpgrade linux-image-6.8.0-35-lowlatencyUpgrade linux-image-5.4.0-189-lowlatencyUpgrade linux-image-6.8.0-1008-azureUpgrade linux-image-oem-24.04Upgrade linux-image-ibmUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-5.15.0-1062-kvmUpgrade linux-image-5.15.0-116-lowlatency-64kUpgrade linux-image-lowlatencyUpgrade linux-image-5.15.0-116-generic-64kUpgrade linux-image-6.8.0-1008-gcpUpgrade linux-image-nvidiaUpgrade linux-image-ibm-classicUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-oem-osp1Upgrade linux-image-6.8.0-1009-aws | Jul 1, 2024 | May 1, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub